Vulnerabilities

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability in the DeleteBranchPost function eenables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only. Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms. In oder to exploit this vulnerability, attackers must have write permissions to the target repository, protected branches configured to the target repository and access to the Gogs web interface. This issue has been fixed in version 0.14.1.

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVE-2025-8110 is a path-traversal flaw (CWE-22) caused by improper symbolic-link handling in the PutContents API of the self-hosted Git service Gogs. An attacker with low-privileged access to the API can abuse symlinks so that file operations escape the intended directory, resulting in code execution on the server hosting Gogs. Because the attack works over the network with only low privileges and no user interaction, any Gogs deployment whose API is reachable — particularly internet-facing instances — is exposed. This is a zero-day: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-12 after reports of active attacks against 700+ instances, and at the time of the KEV listing no official patch was available, though a fix was in progress in Gogs pull request #8078. EPSS assigns an 82.5% probability of exploitation within 30 days (100th percentile), and CISA's required action is to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Do: Because no official patch was released at the time of the KEV listing, track gogs/gogs PR #8078 and upgrade to the fixed release as soon as it ships; in the interim, follow CISA's required action by applying vendor mitigations or restricting or discontinuing internet exposure of Gogs instances. Reduce attack surface by limiting low-privileged account access to the PutContents/write APIs and firewalling Gogs servers, and hunt for indicators of compromise on any internet-facing Gogs deployment given confirmed attacks against 700+ instances.

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.

CVE-2024-55947 is a path traversal flaw (CWE-22) in Gogs, an open source self-hosted Git service, that allows a malicious user to write a file to an arbitrary path on the server. It requires only low privileges, so any authenticated Gogs user can trigger it over the network without user interaction, and by planting a file in a sensitive location — such as the service account's SSH authorized_keys — the attacker gains SSH access to the host, effectively compromising the server (high confidentiality, integrity, and availability impact per CVSS). All Gogs deployments running versions prior to 0.13.1 are affected. Exploitation is no longer theoretical: recent reporting describes active attacks hitting 700+ instances, and CISA has flagged the flaw as actively exploited, adding it to its Known Exploited Vulnerabilities catalog. EPSS assigns a 75.2% probability of exploitation within 30 days (99th percentile), underscoring elevated risk for exposed instances.

Do: Upgrade all Gogs instances to 0.13.1 or later, which fixes this flaw, and treat the upgrade as urgent given active exploitation and the KEV listing. Check your deployed version, audit the host for rogue SSH keys and unexpected file writes (especially the git service account's authorized_keys), and review account activity and logs for signs of compromise. Until patched, limit network exposure of the Gogs service and the server's SSH port, and restrict account creation to trusted users.

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.

Gogs through 0.13.0 allows deletion of internal files.

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/file.php component.

Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.9 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions.

taocms <=3.0.2 is vulnerable to Cross Site Scripting (XSS).

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the edit_meta_value() function. This makes it possible for unauthenticated attackers to edit meta field values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in admin.php.

A vulnerability was found in jja8 NewBingGoGo up to 2023.5.5.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228167.

A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225330 is the identifier assigned to this vulnerability.

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php.

The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).

The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.

An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php.